hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-28 02:05:14 +02:00
Code Issues Packages Projects Releases Wiki Activity

JS: make Closure::moduleImport handle member access.

Browse Source
This commit is contained in:
Asger F
2019-02-08 10:45:19 +00:00
parent 0558b58193
commit bfe88e9784
7 changed files with 80 additions and 46 deletions
Download Patch File Download Diff File Expand all files Collapse all files

17
javascript/ql/src/semmle/javascript/Closure.qll
View File

@@ -170,9 +170,11 @@ module Closure {
isLibraryNamespacePath(result) and
node = DataFlow::globalVarRef(result)
or
isLibraryNamespacePath(result) and
exists(DataFlow::PropRead read | node = read |
result = getLibraryAccessPath(read.getBase().getALocalSource()) + "." + read.getPropertyName()
exists(DataFlow::SourceNode base, string basePath, string prop |
basePath = getLibraryAccessPath(base) and
isLibraryNamespacePath(basePath) and
node = base.getAPropertyRead(prop) and
result = basePath + "." + prop
)
or
// Associate an access path with the immediate RHS of a store on a closure namespace.
@@ -194,16 +196,9 @@ module Closure {
}
/**
* Gets a dataflow node that refers to the given Closure module.
* Gets a dataflow node that refers to the given value exported from a Closure module.
*/
DataFlow::SourceNode moduleImport(string moduleName) {
getLibraryAccessPath(result) = moduleName
}
/**
* Gets a dataflow node that refers to the given member of a Closure module.
*/
DataFlow::SourceNode moduleMember(string moduleName, string memberName) {
result = moduleImport(moduleName).getAPropertyRead(memberName)
}
}